If you are using spring boot for you project then you can add
server.servlet.session.tracking-modes=cookie
in application.properties file to prevent exposing jsession id in url